From patchwork Wed Mar 29 06:10:18 2017 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Michael Scott X-Patchwork-Id: 96179 Delivered-To: patch@linaro.org Received: by 10.140.89.233 with SMTP id v96csp2045819qgd; Tue, 28 Mar 2017 23:10:51 -0700 (PDT) X-Received: by 10.99.135.193 with SMTP id i184mr33462355pge.120.1490767851215; Tue, 28 Mar 2017 23:10:51 -0700 (PDT) Return-Path: Received: from vger.kernel.org (vger.kernel.org. [209.132.180.67]) by mx.google.com with ESMTP id 3si4771490plt.33.2017.03.28.23.10.51; Tue, 28 Mar 2017 23:10:51 -0700 (PDT) Received-SPF: pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) client-ip=209.132.180.67; Authentication-Results: mx.google.com; dkim=pass header.i=@linaro.org; spf=pass (google.com: best guess record for domain of netdev-owner@vger.kernel.org designates 209.132.180.67 as permitted sender) smtp.mailfrom=netdev-owner@vger.kernel.org; dmarc=pass (p=NONE sp=NONE dis=NONE) header.from=linaro.org Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753244AbdC2GKu (ORCPT + 6 others); Wed, 29 Mar 2017 02:10:50 -0400 Received: from mail-ot0-f176.google.com ([74.125.82.176]:36464 "EHLO mail-ot0-f176.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752930AbdC2GKs (ORCPT ); Wed, 29 Mar 2017 02:10:48 -0400 Received: by mail-ot0-f176.google.com with SMTP id t8so3817941otf.3 for ; Tue, 28 Mar 2017 23:10:47 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=linaro.org; s=google; h=from:to:cc:subject:date:message-id; bh=PYLAF6pklKoDSby/HDhRg+uFGohijxLQUeM1No+DMfw=; b=U//PXTQIg6aLmNHk4PxgPDmSo8tznE9hiX9KEjyFbf0zBPpcpg/jC+wZVO1KgrXY5V OngA0rfBsKrO3A3O0cyAJupsq15ubc9qJ8mO18ZFrnjSzt7l0ZwM4c0jchQDg0gHuHnn lAwMG+pqu8DwcFhjlwW7Fi2Zn97pu2rkCLM8M= X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20161025; h=x-gm-message-state:from:to:cc:subject:date:message-id; bh=PYLAF6pklKoDSby/HDhRg+uFGohijxLQUeM1No+DMfw=; b=EMC7JXnyH1hK/DuPxyZw/HMXHB5XduFwcxWzgY1uPYE+OtV0ixfFosigAU5ZeBXVUw kw4xA8MugSlDCp2nyK4LcZGD1dJ5YeNpcqKkTEvmQc1asMg8SLfs2t5Lo5wkafnDeSiX caWiKaa46c1+jExw6cT3DN3SCCxe0K1KJ5LX02lvTc8HevoU65UvTXIIJTvkLBKKi6Oo GD4GdlRHZeJ1jPouKPFI4tf8zgv2RfHeY1Bgocs3O/pu98FCRMb/NH7HkHqH/I9xoi3F SMfdGlqrIYGf/T2qqGKYaZpz/474mQDYcvU5Iy6OJ8V3RyO1hroMm+wDWaT22J84hM+t z+Rw== X-Gm-Message-State: AFeK/H1itBTseGeB/3TlBwFqSpWqYii84W94ybz9cT9cTli8cerYaq0tJ0yq/el4eueyQ2cL X-Received: by 10.157.30.198 with SMTP id n64mr15081454otn.133.1490767847379; Tue, 28 Mar 2017 23:10:47 -0700 (PDT) Received: from localhost.localdomain (107-198-5-8.lightspeed.irvnca.sbcglobal.net. [107.198.5.8]) by smtp.googlemail.com with ESMTPSA id p47sm2919551otp.23.2017.03.28.23.10.46 (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Tue, 28 Mar 2017 23:10:46 -0700 (PDT) From: Michael Scott To: Marcel Holtmann , Gustavo Padovan , Johan Hedberg Cc: "David S . Miller" , Jukka Rissanen , linux-bluetooth@vger.kernel.org, linux-wpan@vger.kernel.org, netdev@vger.kernel.org, linux-kernel@vger.kernel.org, Michael Scott Subject: [PATCH] bluetooth: 6lowpan: fix use after free in chan_suspend/resume Date: Tue, 28 Mar 2017 23:10:18 -0700 Message-Id: <20170329061018.4243-1-michael.scott@linaro.org> X-Mailer: git-send-email 2.11.0 Sender: netdev-owner@vger.kernel.org Precedence: bulk List-ID: X-Mailing-List: netdev@vger.kernel.org A status field in the skb_cb struct was storing a channel status based on channel suspend/resume events. This stored status was then used to return EAGAIN if there were packet sending issues in snd_pkt(). The issue is that the skb has been freed by the time the callback to 6lowpan's suspend/resume was called. So, this generates a "use after free" issue that was noticed while running kernel tests with KASAN debug enabled. Let's eliminate the status field entirely as we can use the channel tx_credits to indicate whether we should return EAGAIN when handling packets. Signed-off-by: Michael Scott --- net/bluetooth/6lowpan.c | 21 +++------------------ 1 file changed, 3 insertions(+), 18 deletions(-) -- 2.11.0 diff --git a/net/bluetooth/6lowpan.c b/net/bluetooth/6lowpan.c index d491529332f4..e27be3ca0a0c 100644 --- a/net/bluetooth/6lowpan.c +++ b/net/bluetooth/6lowpan.c @@ -38,7 +38,6 @@ struct skb_cb { struct in6_addr addr; struct in6_addr gw; struct l2cap_chan *chan; - int status; }; #define lowpan_cb(skb) ((struct skb_cb *)((skb)->cb)) @@ -528,7 +527,7 @@ static int send_pkt(struct l2cap_chan *chan, struct sk_buff *skb, } if (!err) - err = lowpan_cb(skb)->status; + err = (!chan->tx_credits ? -EAGAIN : 0); if (err < 0) { if (err == -EAGAIN) @@ -964,26 +963,12 @@ static struct sk_buff *chan_alloc_skb_cb(struct l2cap_chan *chan, static void chan_suspend_cb(struct l2cap_chan *chan) { - struct sk_buff *skb = chan->data; - - BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb); - - if (!skb) - return; - - lowpan_cb(skb)->status = -EAGAIN; + BT_DBG("chan %p suspend", chan); } static void chan_resume_cb(struct l2cap_chan *chan) { - struct sk_buff *skb = chan->data; - - BT_DBG("chan %p conn %p skb %p", chan, chan->conn, skb); - - if (!skb) - return; - - lowpan_cb(skb)->status = 0; + BT_DBG("chan %p resume", chan); } static long chan_get_sndtimeo_cb(struct l2cap_chan *chan)